Real-time protection without the startup panic

The steps, in order

1. 1

   Step 1

   chokidar walks the Downloads, Desktop and Documents trees at start-up. Events appear after this 10–12 second window.

2. 2

   Step 2

   Choose the action on detection: report (notify the dashboard only) or quarantine (move the file to encrypted quarantine). Report is less destructive, quarantine is safer on shared endpoints.

3. 3

   Step 3

   Events flow through SSE to the dashboard, so there is no need to reload. The live monitor shows the connection state.

4. 4

   Step 4

   Files in watched folders are scanned with deep: false. If you want deep analysis on a specific file, start an explicit scan on it.